{"record":{"id":"0e99b626e21a595f","repo":"deepseek-ai/deepseek-harness","slug":"aclsandbox-private-temp-directory-must-be-disjoint","errorCode":null,"errorMessage":"AclSandbox private temp directory must be disjoint from writable directories: writable=${writableDir}; temp=${tempDir}","messagePattern":"AclSandbox private temp directory must be disjoint from writable directories: writable=(.+?); temp=(.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/sandbox/sandbox-windows-acl/src/path-boundary.ts","lineNumber":37,"sourceCode":" * @param workspaceRoot - the canonical workspace root that receives the standing ACE.\n * @param tempRoot - the existing parent beneath which a private temp child would be created.\n */\nexport function assertTempRootOutsideWorkspace(workspaceRoot: string, tempRoot: string): void {\n  if (containsDirectory(workspaceRoot, tempRoot)) {\n    throw new Error(`Windows ACL temp root must be outside the workspace: workspace=${workspaceRoot}; temp=${tempRoot}`)\n  }\n}\n\n/**\n * Reject overlap between an actual private temp directory and any writable\n * directory: either inheritance direction would merge the two capabilities.\n * @param writableDirs - directories carrying the standing workspace capability.\n * @param tempDir - the existing directory carrying the revocable temp capability.\n */\nexport function assertPrivateTempDisjoint(writableDirs: readonly string[], tempDir: string): void {\n  for (const writableDir of writableDirs) {\n    if (containsDirectory(writableDir, tempDir) || containsDirectory(tempDir, writableDir)) {\n      throw new Error(`AclSandbox private temp directory must be disjoint from writable directories: writable=${writableDir}; temp=${tempDir}`)\n    }\n  }\n}\n","sourceCodeStart":19,"sourceCodeEnd":41,"githubUrl":"https://github.com/deepseek-ai/deepseek-harness/blob/b150a551b8d465e31e418e1b2eaf5e79bbb7d28e/packages/sandbox/sandbox-windows-acl/src/path-boundary.ts#L19-L41","documentation":"Error \"AclSandbox private temp directory must be disjoint from writable directories: writable=${writableDir}; temp=${tempDir}\" thrown in deepseek-ai/deepseek-harness.","triggerScenarios":"Thrown at packages/sandbox/sandbox-windows-acl/src/path-boundary.ts:37 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Choose a private temp directory that is not inside and does not contain any writable directory."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"b150a551b8d465e31e418e1b2eaf5e79bbb7d28e","analyzedAt":"2026-08-24T18:12:29.105Z","schemaVersion":2},"datasetVersion":"2026-08-24T22:17:12.610Z"}